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SYSTEM OVERVIE' 



1. Designed as a tactical tool for law enforcement, Government agencies and the 
Military, the GSM-XP family of GSM active interception solutions have proven to be a 
global hit with proven success in the field. 



2. Based on commercial base-station technology this offers a quantum leap in mobile 
acquisition rate, higher transmit power, operational ranges and for the first time 
simultaneous operation on multiple networks and simultaneous servicing of multiple 
targets. 
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3. Key features include: 

• Up to 50 Watts output power on 2 simultaneous channels 

• Up to 4 simultaneous channels, allowing emulation of: 

- 4 broadcast channels on one network 

- 4 broadcast channels on four different networks 

• Dual band solutions covering 900/1800 or 850/1900 MHz and for the first time 
a world box providing 850/900/1 800/1 900MHz capability. 

• Real time monitoring and intercept of up to 4 simultaneous calls. 

• Integrated antenna switch on the vehicle models. 

• Capability to service multiple targets - up to 7 targets per carrier. 

• Ruggedised carry-case. 

• Multiple form factors to cover different operational scenarios. 

4. The vehicle model is designed for customers with an ‘in-country’ requirement, i.e. 
operation within their own borders. 

5. The nature of the installation allows the system to transmit up to 50 Watts which 
when added to the improved receive sensitivity and channel equalisation dramatically 
extends the range. 

6. In addition the system will support multiple channels simultaneously to a maximum 
of 4 channels within the unit. 

7. The PV system is supplied with a bench top power supply to allow normal use when 
not installed in a vehicle. 
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Primary Equipment 

8. The vehicle is fitted with the following primary equipment which is described 
individually in the appropriate sections of this manual. 



Equipment Description 


Qty 


Battery Charger 


2 


Control Terminal 


1 


Radio Antenna-Directional 


2 


Radio Antenna-Omni-directional 


2 


Radio Antenna-Call Forward 


1 


Toughbook Laptop 


2 


XPZ Euro PV System 


1 



9. The following table lists the types of equipment installed in this vehicle which can be 
classified as secondary equipment. 

Secondary Equipment 



Equipment Description 


Qty 


Mains Charger Protection Unit 


1 


Mains Charger Socket 


1 


Mains Charger Cable & RCD 


1 


Power Distribution Box 


1 


Protection Fuse 60Amp 


4 


Two Tone Charging Alarm 


1 



10. The Secondary Equipment items are explained in more detail 
sections of this manual. 



in the appropriate 
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SYSTEM LAYOU 



Access 

11. Access to the main equipment compartment is gained via the split tailgate. 

12. Refer to the section titled Powering Up The System for information regarding 
powering up the system from the front cab mounted Control Terminal. 

13. Refer to the section titled System Fuses & Protection which provides details of the 
protection fuses used in this installation. 



Driver’s Cab 
Control Terminal 




15. Further facilities to be described later include battery management, power outlets for 
charging laptop batteries, and interface sockets linking a laptop or laptops to the XPZ 
Euro PV system. 

16. The battery compartments for the XPZ Euro PV system are mounted to the rear 
nearside and offside of the vehicle and accessible via the rear split tailgate. 
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XPZ Euro PV SYSTEM 



17. The GSM-XPZ is controlled from a ruggedised Toughbook laptop connected to the 
unit via standard TCP/IP networking. 




Schematic System Diagram 
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Antenna Configuration 

18. Three types of antenna are used in conjunction with the GSM-XPZ: 

• Directional antenna supplied with the unit is a flat panel antenna. It features 
strong signal gain in the direction of transmission which makes it ideal for use 
in situations where bearing to target is known. 

1 9. Two of these antennas are used, one for each side of the vehicle and located on the 
side panelling of the rear compartment. 

• Omnidirectional antenna transmits over 360° on the horizontal plane. This 
antenna is suited to scenarios where bearing to target is unknown. 

20. Two of these antennas are used, one for each side of the vehicle and located on the 
side panelling of the rear compartment. 

21. The GSM-XPZ features an integral antenna switch that is controlled from the 
software on the control laptop. This means that the operator can quickly and easily 
change between different antenna configurations using the switch control in the 
software. 

22. The GSM-XPZ has six antenna outputs: two high band outputs, two low band 
outputs and two dual band outputs. 

23. In addition to the output antennas, the GSM-XPZ has a network monitor antenna 
which provides signal for the GSM-XPZ’s integrated phone modules. The phone 
modules are used to survey GSM networks present in the vicinity of the unit, and to sign 
on to local network cells for the purposes of neighbour list decoding and call forwarding. 

Generic Features 

• Ability to adjust BTS power to a maximum 50W. 

• Ability to transmit 4 GSM broadcast channels simultaneously. 

• Enhanced IMSI acquisition rate (theoretically to 60 registrations per BTS per second) 

• Intercept of 4 outgoing target calls simultaneously. 

• Perform a Blind Call per GSM timeslot = 7 blind calls simultaneously per channel. 

• Up to 28 Simultaneous Blind Calls whilst IMSI Grabbing. 

• Advanced manipulation of BCH data to ensure better phone retention (once locked). 

• Ability to survey spectrum using custom phone modules. 

• Display of SERVER & 6 neighbouring cell information to enable simple cell 
emulation. 

• Ability to adjust target mobile power once in a call to maximum 2W transmission. 

• Visual indication of RX power level (mobile reporting BTS received signal strength). 

• Advanced configuration of BTS for emulation of any network type. 
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• Off-line mode for mission file viewing. 

• Powerful database search facility for quick target identification. 

• Multiple antenna management using In-built antenna switching circuitry. 

• Remote system operation via wireless link. 

Control Options 

24. The GSM-XPZ is controlled from a ruggedised Toughbook laptop connected to the 
unit via standard TCP/IP networking. 

25. To provide users with maximum flexibility a range of control options is available. 
Direct Ethernet connection to the controlling laptop; wireless connection using a suitably 
enabled device e.g. PDA, Laptop etc. In this mode multiple users will be able to connect 
and view the following information over a secure connection: 

- Target Identification - included as standard. 

- Voice Intercept (only available on PV variant). 

SMS Intercept. 

- Direction Finding Support. 

- Service Denial. 

Bubble Mode. 

26. The operator will be able to adapt the Graphical User Interface (GUI) to display the 
key information. The GUI will build on the familiarity of the existing GSM-XP to provide 
both novice and experienced users with the control to easily, and simultaneously, 
operate 4 base stations. 

27. To enhance security, mission data is stored on an external memory device. This can 
be easily switched between multiple systems, or used to examine mission data offline 
on a separate PC or on the GSM-XPZ itself. 

28. This also allows for protection of mission data, should the system have to be loaned 
to other organisations or returned to MMI. 

29. All events as per current GSM-XP operation will be time stamped and logged in a 
mission file along with intercepted Voice/SMS data. 

30. To maintain the integrity of the data the mission files cannot be edited or recorded 
voice replayed without using MMI software. 
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Operational Modes 

Research & Release 


Allows phones from up to 4 networks to simultaneously 
attach to the GSM-XPZ enabling their IMSI / IMEI to be 
logged. Once logged, they are released back to the real 
network - the most covert operational mode. 


Research & Lock 


Locks selected target phones to the GSM-XP BTS 


Ping Mode 


Clones the selected BTS exactly including LAC. A much 
quicker and more efficient way of capturing mobiles as it 
removes the overheads associated with a location update 
- the least covert operational mode. 


Bubble Mode 


Unless otherwise specified all phones registering to the 
system will be locked to the system thus creating a bubble 
of phones restricted from accessing the real networks. 


Service Denial to all 


Sends a service denial message to all phones, and 


Hostiles 


potential hostiles, that prevents them from rejoining a real 
network. 


Exclusive Network 


Allows friendly phones to use the XPZ as a means to 
covertly contact other operatives. Calls made in this way 
do not use the real network and are therefore secure. 


Target Mobile Actions 

Overt Call 


Allows operator to call a target phone and optionally 
converse. 


Blind Call 


Covert (silent) call to a target phone. Used in conjunction 
with directional finding equipment. 


Send SMS 


Allows operator to send SMS to a target phone. 


SIM Swap Indication 


Shows indication of SIM swap. 


Make Target 


Allows operator to make a phone a target. 


Invalidate Target 


Allows operator to deny service to a selected target. 


Make Reject 


Allows operator to reject selected phones from the GSM- 
XP to prevent any interference by the system. 


Show Target History 


Shows all recorded activity by the target phone. 



Setting up Procedure 

80. Before the deployment of the system the operative must read and familiarise 
themselves with the manufacturer’s Operating Instructions. 
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In-Line Fuse 

31. Two in-line 60Amp fuses are connected between the batteries and the “flying lead" 
supply cable in each case. 

32. These are designed to protect a battery from excessive current drain. 

33. These are installed on the sides of the battery compartments and one of these fuses 
is shown here for reference purposes. 

34. A second unit is employed in the negative lead of each battery supply cable. 

35. They are encapsulated in a protective removable plastic cover which is shown in the 
image below. 

36. The image shown opposite illustrates the unit with the cover removed for reference 
purposes. 









In-Line 60A Fuse Unit 
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Charging Unit Fuse 




The charging units may. only be used, when the 
vehicle is stationary, with the engine turned OFF 
and, with access to a domestic mains supply . 

A built in unit protection fuse (25Amp) is located 
to the left hand side of the unit. Replacement of 
this fuse necessitates the removal of the mains 
supply from the vehicle for safety reasons. 



37. This is shown here for reference purposes. 




Protection fuse 



System Protection 

38. A fused panel is employed to protect the on-board mains charger systems. This is 
co-located with the two battery chargers and the mains input socket which are mounted 
on top of the offside battery compartment cover. 

39. Refer to the image shown here as a reference. 




Instructions for TEST 

With a mains supply connected to the 
vehicle via the mains input socket press 
the ON button and check that the red lamp 
is lit. 

Press the TEST button and check that the 
red lamp extinguishes. 

If it does not, disconnect the supply and 
replace the fuse. 

The rated fuse for this device is 1 3Amps. 

Replace by unscrewing the securing 
screw, lift the fuse cradle and remove the 
fuse. Replace with the same rated fuse. 

Relocate the cradle and tighten retaining 
screw. Carry out test again. 
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System Batteries 

40. The vehicle XPZ Euro PV system is powered by a 2 x 12V/210VAH dryfit heavy duty 
batteries. 

41. They obtain their charge through separate portable mains chargers which are hard 
wired into a mains socket distribution panel installed alongside the protection fuse 
described earlier. 

42. An image of one of the chargers is shown here for reference purposes. 



43. Connect the mains cable to a domestic AC mains supply ensuring the supply is 

OFF 

44. Connect the cable plug to the input socket shown above. 

CAUTION: In the event that the vehicle ignition is turned on with the mains 




Battery Charging Procedures 

Mains Supply Charging Socket 




When mains charging is not taking place the protective 
cover MUST be used to prevent the possibility of 
damage to the unit’s pins. 



<s> 




supply cable still connected, a two tone alarm will sound, warning 
the driver NOT to move off with the cable still attached to the vehicle. 



CONFIDENTIAL 







elaman ? 

Qif TtM A N HCUPmr SOIVTIPNS 




Mains Cable RCD Safety Plug 

45. The unit must be tested before it is used and every time it is used! 

46. The RCD Plug continuously monitors the power supply to an electrical appliance 
and cuts off the power within 40 milliseconds if an earth current fault is detected. 

47 This will prevent a fatal electrical shock- 




instructions for TEST 



• Insert the RCD plug into a 13Amp mains 
socket and switch the supply on. 

• Press the RESET button. 

The ORANGE indicator should appear. 

• Press the TEST button. 

The ORANGE indicator will disappear from the 
CLEAR window. 

DO NOT USE IF THE ORANGE INDICATOR 
REMAINS. 



a. Press the TEST button. 

The RCD has now been set for safe use 
provided the ORANGE indicator shows in the 
CLEAR window. 



48. There are no user serviceable parts within the unit other than a domestic fuse and 
failure of any item must entail the return of the said item to Sonic Communications 
(Int.) Ltd. for repair. 



49. The 13Amp fuse shown in the image above which is a domestic product can be 
replaced if proven to have “blown”. 



50. The cause of the fuse failure MUST be investigated and appropriate corrective 
action earned out before replacement of the fuse and subsequent use of the unit . 

51. The fuse is housed in the red box located between the socket pins on the base of 
the RCD. 



52. To replace, use a small electrical screwdriver to remove the securing screws/cover 
and eject the fuse. A new fuse can be pushed home and the cover replaced. 

XPZ Euro PV Battery Pack 

53. With the mains RCD plug connected to a domestic AC mains supply and the cable 
socket connected to the mains input socket on the vehicle and, with the mains switched 
ON, the chargers will start to charge the batteries as and when necessary. 

54. Use the battery charging procedures provided to check the status of the batteries 
via the charger LED’s. 
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Charger LED Description 



Boost 

The charging current is maximum and at the same time 

the battery voltage is lower than the switching level of the timer. 

Orange LED indicates that it would be approved for medical use. 




Timer 

The charger is in time-controlled mode. 

The charger current is lower than maximum. 

The battery is normally between 80 and 95% charged when 
the time-controlled mode starts (LED changes to yellow). 
The battery voltage is the same as the switch level from 
rapid charging, The charger remains in this mode until 
the time interval is completed. 




Float 

The charger is in standby mode. 

The battery is fully charged (LED changes to green). 

The charge voltage is at standby level which means that 
the charger can continue to be connected to the battery. 

The charger can return to rapid charging if the battery is used. 
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Powering Up the System 

55. Operator’s are strongly advised to read and familiarise themselves with the various 
manufacturer’s instructions relating to the setting up and operation of the following 
facilities: 

i. XPZ Euro PV System. 

ii. Toughbook Laptop: Instructions for this facility are provided. 

iii. DCM Display Console: Instructions for this facility are included in this 
publication. 

iv. Portable 3 Step Battery Charger: Instructions for this facility are provided. 

Ensure that the system batteries are fully charged before each deployment. 

12V DC Charging Socket 12V DC Charging Socket 



56. The console is located centrally in the front of the vehicle behind the front seats and 
connected to the main system via an umbilical cable. 



Control Terminal Front Panel 




Main Supply Switch 
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57. This provides for laptop battery charging facilities, data connectivity between a 
laptop and the XPZ Euro PV system, and remote ON/OFF switching for the XPZ Euro 
PV system. 

58. It also provides a visual display and menu driven facility for battery management. 

59. The Main Supply Switch (MASTER ON/OFF) provides both 12V DC and 24V DC to 
the whole system as required. 

60. The 600-DCM3.2 Battery Monitor offers the following features: 

• 1/1 0th of an Amp resolution in the range of +/- 0-50A 

• The Matrix Monitors use a dot Matrix LCD allowing for Full screen information 
on Function selected. 

• Voltage monitoring for up to 3 battery banks. 

• 12 custom selectable legends eg: Start Battery, House Battery etc. 

• Hi/Low voltage alarm on all 3 banks. 

• Amps charge and discharge on house bank only. 

• Meter supplied with a 450-50mV shunt. 

• Capacity remaining in amp hours and percentage. 

• Low amp hour alarm. 

• Suitable for use on battery banks 60-3000 Amp hours. 

61 . Two 12V DC sockets are provided to enable the operator’s to charge both laptops at 
the same time should the need arise. 

62. Two laptop input sockets are provided, CAT 5E-BLUE, and Cat 5E RED. 

63. The outputs from the Control terminal are shown in the next image showing the 
base of the Terminal. 

Control Terminal Base 
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System Wiring Schedule 

64. The diagram shows the interconnectivity between the Control Terminal, Power 
Distribution Box, and the XPZ Euro PV system. 



CONTROL TERMINAL 
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Monitor & Display Options 





Voltage Monitor 

• Voltage monitoring for up to 3 banks. 

• 12 custom selectable legends. 

• Hi/Low voltage alarms on all 3 banks. 




Amps Charge & Discharge 

• Monitored on house bank only. 

• 450-50mv shunt supplied with meter. 

• Resolution 0.1 amps up to 40 amps. 



Amp Hour Monitoring 

• Monitored on house bank only. 

• Software utilises Peukerts exponent. 

• Suitable for battery banks 60 to 3000Amp 
Hrs. 

• Low amp hour alarm. 



Note: The values shown here indicate what the display looks like for each of the 
parameters being monitored. The actual values depend on the installation 
requirements. 
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OPERATING INSTRUCTIONS 



Apply Power 

Power-up screen will show for 5 seconds 
After 5 Seconds 

First screen shows the Supply Battery Volts. 

Press Button V 

The second screen shows 2nd Battery volts. 

Press Button V Again (3RD position as volt monitor) 
The third screen shows the 3rd battery volts. 

Press Button V Again (3RD position as bilge monitor) 
The third screen shows the bilge monitoring 
information. 

• In bilge monitor function press and hold “C” to 
reset the monitor back to zero. 

To exit Bilge monitoring mode and resume battery 
monitoring press “V” to return to supply battery volts. 

Press Button A 

This screen shows either charging 
OR discharging Amps. 

Press Button C 

This screen shows Capacity Remaining in 
Amp Hours. This will count down when 
Discharging. And count up when Charging. 

Press Button C Again While Viewing Capacity 
This screen will display the remaining 
Amp hours in percentage. 

Alarm Enabled 

When alarms are enabled in the monitor 
setup the alarm symbol will display as shown. 

To Permanently Mute An Alarm 
Press the A button for 2 seconds, the display 
will show the mute symbol as shown, repeat to 
reactivate the alarm. 
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SETUP & PROGRAMMING 



To Enter Programming Mode 
Hold buttons V & C down simultaneously for £ 
seconds the display will read: 

EXIT 
RESET 
SETUP 

Press ‘V’ to exit programming mode. 

Press ‘A’ to enter amps zero and reset mode. 

Press ‘C’ to enter Setup mode. 

Amos Zero (figure 2 ) 

While in programming mode screen (figure 1) 

Press ‘A’ to enter amps zero and reset mode 
Press ‘V’ to exit. 

To Set Amps Zero Point 
Press Button A. 

‘ AMPS ZERO” will flash for approx 2-3 seconds, zero point 
has now been set. The screen will return to the programming 
mode screen (figure 1) 

Factory Reset Mode (figure 2) 

While in programming mode screen (figure 1) 

Press ‘A’ to enter “amps zero” and “reset” mode screen 
(figure 2). 

Press ‘V’ to exit. 

To reset the unit back to factory settings press and hold 
button C until “RESET” begins to flash, release button C, 

The display will continue to flash for approx 2-3 seconds. 

Unit is now reset to factory settings. The screen will return 
to the programming mode screen (figure 1) 



approx. 3 
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SETUP MODE 



Use Up (V) / Down (A) buttons to change value then press C to proceed to the next set up 
screen. 



Set Alarm 

Enable/Disable all alarms 
Default: Enabled 

Battery 1 Label 

Label battery bank 1 options are 
House Batt, House 1 , House 2, 

Start Batt, Stbd Start, Port Start, 

Aux Batt, Radio, Genset 

Battery 2 Label 
As per Battery 1 label 

Battery 3 Label 

As per Battery 1 label except includes 
"Bilge monitor” 

Refer to Operations section 

High Voltage 1 Alarm 

Default: 15.0 Volts 

Up/Down to select value, 0.1 V steps 

Range: 10.0-32.0 Volts 

Low Voltage 1 Alarm 

Default: 1 1 .0 Volts 

Up/Down to select value, 0.1 V steps 

Range: 0.0-32.0 Volts 

High Voltage 2 Alarm 
As per High voltage 1 

Low Voltage 2 Alarm 
As per Low voltage 1 

High Voltage 3 Alarm 
As per High voltage 1 

Low Voltage 3 Alarm 
As per Low voltage 1 
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Low Amp Hours Alarm 
Default: 100 Amp Hours 
Up/Down to select value, 10AH steps 
Range: 0-1000AH 

Maximum Capacity 
Default: 220 Amp Hours 
Up/Down to select value, 10AH steps 
Range: 60-3000AH 

Actual Capacity 

Up/Down to select value, 1AH steps 

Range: 0-3000AH 

Refer to Operations section 

Amo Hour Capacity Reset Voltage 
Default: 13.5V 

Up/Down to select value, 0.1V steps 

Range: 10. 0-30. 0V 

Refer to Operations section 

Amp Hour Capacity Reset Amps 
Default: 5A 

Up/Down to select value, 1A steps 

Range: 0-50AH 

Refer to Operations section 

Charge Efficiency 
Default: 85% flooded lead acid 
Use 90% for Valve regulated gel 
Up/Down to select value, 0.01AH steps 
Range: 0-1.0 (multiple by 100%) 

Refer to Operations section 

Peukerts Exponent 
Default: 1.25 

Up/Down to select value, 0.01 steps 
Range: 1.00-1.50 
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Voltage 1 Calibration 

Adjust this setting to actual battery voltage. 

To Calibrate 

Up/Down to select value, 0.01V steps 
Range: 0-32V 

Refer to Operations section 

Voltage 2 Calibration 
As per Voltage calibration 1 

Voltage 3 Calibration 
As per Voltage calibration 1 

Low & High Amp Calibration 

Note: The load must be applied before entering this 
screen. 

Adjust this reading to correspond with the known load 
that is applied to the system. 

For Low Amp Cal, the known load must be in the range 
+/- 0-50A. For High Amp Cal the known load must be 
within the range +/- 50-450A. 

Note: You only need to do one range of calibration. 

Up/Down to select value. 

Range: +/-450A (Max) 

Refer to Operations section 




Reset Capacity 

NO 

YES 

Reset capacity provides the option to reset the capacity to the programmed value (YES) or 
to leave it at the current monitored level (NO). 
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ALARMS & ALARMS MUTE 



When an alarm condition occurs, the alarm will sound 
and the corresponding display will flash. 
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To permanently mute any alarm, press the A button 
for 2 seconds. The display will show the alarm mute 
symbol. The alarm mute mode will remain set even 
when the power is removed. 
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MAINTENANCE 



Battery Maintenance 

Lead Acid Batteries 

• Leaving a battery standing, even for quite short periods in a very discharged or even 
slightly discharged condition WILL damage your battery! 

This may only be a few days, or a week or so. It’s long enough! It causes the battery 
to become chemically damaged through sulphation. 

This process is the MAJOR cause of ruined batteries. The batteries in this condition 
will hold less charge or go “flat” sooner than they did before. 

In extreme cases they cannot even be re-charged at all, the situation gets worse the 
more often that the user allows the battery to get into this state. 

• Avoid discharging any lead acid type battery too “deeply”as this destroys the active 
plate material. Deep cycle batteries can survive typically 300 / 80% discharges only. 

• Remember - The secret to long battery life is to discharge them as little as possible 
(operational constraints can make this situation unavoidable) and to charge them 
back up as soon as it is possible to do so. 

• If a battery fails it is extremely unlikely to be the fault of the battery, but very likely to 
be as a result of a lack of understanding of the chemistry involved and incorrect 
usage. 

Safety & Handling 

• Always wear proper eye, face and hand protection when working with battery. 

• Never lean over battery while boosting, testing, or charging. 

• Exercise caution when working with metallic tools or conductors to prevent short 
circuits and arcing. 

• Keep terminals protected to prevent accidental shorting. 

• Replace any battery that has signs of damage to the terminals, case, or cover. 

• Install battery in a ventilated area for operation and during charging. 

65. The following message chart illustrates the warnings that you may find on the casing 
of a battery. 

66. DO NOT expect to see them all on every battery you come into contact with but take 
note of any warning that you see. 
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CERTIFICATION DOCUMENTS 



67. The certificate(s) which are to be found to the rear of this manual are applicable to 
this installation and are identified below. 

68. If a document is lost or is deemed illegible for whatever reason, a replacement copy 
can be provided. 

69. Contact Sonic Communications (Int) Ltd in the first instance using the telephone 
number provided in the NOTE page of this publication. 

70. This installation requires the following certificates: 

Declaration of Conformity 

71. This certificate provides information regarding equipment that conforms to EMC 
specification and compliance with the automotive EMC Directive 95/489-5/EC. 
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Telephone: +44 (0) 121 781 4400 (Switchboard) 
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If you would like further Information about ELAMAN, 
or would like to discuss a specific requirement or project, please contact u$ at: 

Elaman GmbH 
German Security Solutions 
Seitzstr.23 
80538 Munich 
Germany 

Tel: +49-89-24 20 91 80 
Fax: +49-89-24 20 91 81 
info@elaman.de 
www.elaman.de 






